Assumptions

Assumptions are conditions or scenarios accepted as true during the threat analysis and risk assessment (TARA) process to facilitate the evaluation of cybersecurity risks. According to ISO/SAE 21434, these include attacker capabilities, available tools, system boundaries, and environmental conditions. They serve as the foundation for cybersecurity claims—without valid assumptions, claims cannot be reliably justified. This concept is critical for ensuring that the cybersecurity case is robust and verifiable, preventing underestimation of risks due to unstated or unrealistic premises. In the context of ISO/SAE 21434, assumptions must be documented, traceable, and regularly reviewed throughout the vehicle's lifecycle to ensure ongoing compliance and-risk-adjusted-measures.

The application of assumptions in automotive cybersecurity follows a three-step approach: First, the definition phase, where engineers specify attacker capabilities (e.g., skill level, equipment), system boundaries, and environmental constraints. Second, the integration phase, where these assumptions are used to calibrate the Attack Feasibility rating within the TARA process, ensuring each threat scenario is evaluated under consistent conditions. Third, the verification phase, where assumptions are tested against real-world findings or penetration testing results. For example, a European-based Tier 1 supplier implemented a structured assumption-tracking system, which reduced the time spent on re-evaluating threats by 25% during the final validation phase. This systematic approach ensures that the cybersecurity case remains valid even as the threat landscape evolves.

Taiwanese automotive suppliers typically face three challenges: lack of quantitative criteria for assumptions, insufficient cross-functional collaboration, and the absence of a lifecycle management process. To overcome these, enterprises should first adopt standardized rating scales for attacker capabilities, as suggested by ISO/SAE 21434, to ensure consistency across different engineers. Second, establishing a Cybersecurity Working Group—comprising design, software, and quality teams—is essential to ensure assumptions are understood and implemented at the code level. Finally, companies must integrate assumption-checking into their post-SOP (Start of Production) monitoring and OTA update processes. A phased implementation starting with a single subsystem can be completed within 6 months, providing a scalable model for the entire organization.

Winners Consulting Services Co., Ltd. specializes in assisting Taiwan automotive suppliers with ISO/SAE 21434 compliance and TISAX certification. We provide a structured 90-day implementation roadmap that moves from assumption-building to full cybersecurity case documentation. Our expertise ensures your company meets the stringent requirements of global OEMs, avoiding costly late-stage redesigns. For a free mechanism diagnosis, please visit: https://winners.com.tw/contact